Proofpoint Email Fraud Defence — DMARC, BEC & Impersonation

① Why email fraud works — trust, not malware

BEC (Business Email Compromise) is a social-engineering attack delivered over email, not a malware attack. The goal is to convince someone — a finance team member, an IT admin, a new employee — to wire funds, change payment details, or hand over credentials. Because there is no payload, traditional antivirus and many spam filters give these messages a clean bill of health.

There are four main attack patterns you must be able to name. CEO fraud (or executive impersonation) spoofs or compromises a senior leader's identity and orders an urgent action. Supplier invoice fraud impersonates a known vendor and asks for a payment-detail update. Display-name spoofing sets the visible From name to 'John Smith — CEO' while using an attacker-owned domain in the actual address. Lookalike domains register a convincing near-copy of a real domain (e.g. techc1ick.in) and use it to send fraud.

The critical insight: display-name spoofing and lookalike-domain attacks often pass SPF and DKIM on their own domain — they just happen to not be the domain you trust. Authentication is necessary but not sufficient.

② SPF, DKIM & DMARC — what each standard actually checks

SPF (Sender Policy Framework) is a DNS TXT record that lists the IP addresses and mail servers authorised to send email for your domain. When a receiving server gets a message, it checks the envelope sender (the MAIL FROM address, invisible to the user) against your SPF record. A pass means the sending IP is on your list; a fail means it is not. SPF alone does not protect the visible From: header.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the message headers. The sending server signs the message with a private key; the receiving server looks up the public key in DNS and verifies the signature. A valid DKIM signature means the message body and key headers were not altered in transit and were signed by the claimed domain's key. DKIM survives forwarding; SPF often does not.

DMARC ties them together

DMARC (Domain-based Message Authentication, Reporting and Conformance) does two things: it requires alignment (the domain in the visible From: header must match the domain that passed SPF or DKIM) and it tells receivers what to do with failures — p=none (log only), p=quarantine (send to spam) or p=reject (discard). DMARC also generates aggregate (rua) and forensic (ruf) reports so you can see exactly who is sending on your behalf before you enforce.

③ Proofpoint Email Fraud Defense layers — beyond authentication

Proofpoint Email Fraud Defense (EFD) sits on top of authentication to catch the attacks that pass SPF and DKIM. Three capabilities matter most in interviews and in production.

Display-name and header analysis: EFD compares the visible From: name and address against your executive directory and known-safe senders. If a message claims to be from 'Rajesh Mehta — CFO' but arrives from a Gmail address or an unrelated domain, EFD flags or quarantines it — even if the message passes every authentication check on the sending domain.

Lookalike-domain detection: Proofpoint maintains intelligence on domains that are visually or phonetically similar to your registered domains (e.g. substituting 'rn' for 'm', adding '-invoice', or using homoglyph characters). Incoming messages from these domains are scored and can be flagged or rejected regardless of their own SPF/DKIM status.

Supplier & third-party risk scoring: Most BEC now exploits supplier relationships — attackers either compromise a supplier's mail account or register a lookalike of the supplier's domain. EFD ingests your accounts-payable and CRM data, builds a supplier trust graph, and scores anomalies — new sending IP for a known supplier, content that requests payment changes, or a lookalike domain substituted for a known vendor.

④ Deploying DMARC correctly — and operationalising fraud defence

The single most important deployment rule: never go straight to p=reject. Start with p=none for at least two weeks, collect aggregate (rua) reports, identify all legitimate sending sources (marketing platforms, HR systems, third-party SaaS), and publish SPF and DKIM records for each. Only then move to p=quarantine, watch spam-folder rates for a week, fix any remaining misalignment, and finally promote to p=reject.

Proofpoint EFD adds a DMARC management layer on top of raw DMARC — it parses rua report feeds, maps sending sources to business owners, and provides a dashboard that shows authentication coverage per domain, per sending service. This compresses what normally takes months into a guided workflow.

Incident response with EFD

When a BEC attempt is caught, EFD surfaces the full message header, the sender-domain reputation, the lookalike score and any supplier-trust anomaly in a single pane. For incidents that slip through, Proofpoint supports message retraction (pulling delivered messages back from user inboxes through integration with Microsoft 365 or Google Workspace). Operationally, the right habit is: review the EFD daily digest, tune display-name rules as your executive roster changes, and re-scan your SPF records whenever you onboard a new SaaS vendor.